CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler
A missing notification handler in the Linux kernel CAN J1939 protocol causes a reference count leak, preventing network device unregistration and leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39925?
CVE-2025-39925 is a medium-severity denial of service vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: implement NETDEV_UNREGISTER notification handler
syzbot is reporting
unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
problem, for j1939 protocol did not have NETDEV_UNREGISTER notification handler for undoing changes made by j1939_sk_bind().
Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") expects that a call to j1939_priv_put() can be unconditionally delayed until j1939_sk_sock_destruct() is called. But we need to call j1939_priv_put() against an extra ref held by j1939_sk_bind() call (as a part of undoing changes made by j1939_sk_bind()) as soon as NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct() is called via j1939_sk_release()). Otherwise, the extra ref on "struct j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from dropping the usage count to 1; making it impossible for unregister_netdevice() to continue.
[mkl: remove space in front of label]
Which versions are affected by CVE-2025-39925?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39925?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-39925 being exploited?
There is no known exploitation of CVE-2025-39925 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39925, DEBIAN-CVE-2025-39925, GHSA-g35j-5v93-p28m, ROOT-OS-DEBIAN-11-CVE-2025-39925, ROOT-OS-DEBIAN-12-CVE-2025-39925, ROOT-OS-DEBIAN-13-CVE-2025-39925 and 3 more.